Carpooling Program Website and App Privacy Notice

Last updated on 04.05.2023.

It is important that you read this document (“Privacy Policy”) so that you are aware of what we do with your Personal Data.

Contents

1. Who we are
2. What Personal Data is
3. The purpose of this Privacy Policy
4. Why we collect your Personal Data
5. The kind of Personal Data we collect
6. How we collect your Personal Data
7. How we use your Personal Data
8. Our Legal Bases for Processing Your Personal Data
9. Who we share your Personal Data with
10. Marketing
11. How long we will keep your Personal Data
12. Security of your Personal Data
13. Transferring your Personal Data outside the EU
14. Your rights
15. Your obligations
16. How to contact our Data Protection Officer
17. Questions or Concerns
18. The Data Protection Principles
19. Changes to this Privacy Policy
20. Schedule of Processing – Sets out details of the type of Personal Data being processed for customers, the purpose for which it is processed, the retention period, the legal bases and who has access to
21. Schedule of Processing for potential customers – Sets out details of the type of Personal Data being processed, the purpose for which it is processed, the retention period, the legal bases and who has access to it for potential customers who request a demo or make contact through the

 

1. Who we are

KINTO UK Limited is a limited company registered in England and Wales with company number: 00837940. Its registered address is Building 1000 Lakeside North Harbour, Western Road, Portsmouth, England, PO6 3EN. We are the ‘Controller’ of the Personal Data we collect.

We will process your Personal Data in accordance with all applicable laws, including the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

We use software encompassing an online application (the “App”) and a website: https://www.kinto-join.co.uk (the “Website”) provided by Kinto Join Ltd to deliver carpooling and mobility solutions (the “Kinto Join Carpooling Service”).

We use Kinto Join Ltd to process your Personal Data as a ‘Processor’ on our behalf. Kinto Join Ltd will only process your Personal Data in accordance with our strict instructions.

Kinto Join Ltd is an affiliate company and is a limited company registered in England and Wales with company number: 08598706, at Great Burgh, Burgh Heath, Epsom, Surrey KT18 5UZ.

 

2. What Personal Data is

The term “Personal Data” means any information relating to you that identifies you, or through which you can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier or to one or more factors specific to you physical, physiological, genetic, mental, economic, cultural or social identity.

 

3. The purpose of this Privacy Policy

The purpose of this Privacy Policy is to let you know how we process your Personal Data when you use the Kinto Join Carpooling Service or for potential customers when you request a demo or contact us through our website. This Privacy Policy therefore explains what Personal Data we collect from you and how we collect, use, store and disclose it. This Privacy Policy also contains information about your rights under applicable data protection legislation.

We are committed to compliance with data protection laws. We believe that ensuring data protection compliance is the foundation of trustworthy business relationships.

It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your Personal Data.

This Privacy Policy sits alongside the terms and conditions (“T&Cs”) https://app.kinto- join.co.uk/corp/terms-and-conditions/?country=united_kingdom&language=en which we also encourage you to read.

 

4. Why we collect your Personal Data

We collect your Personal Data for the purpose of providing you with the Kinto Join Carpooling Service or when you make enquiries through our website.

We offer corporate carpooling groups which, are free to join and are offered via our corporate customers (“Corporate Carpooling Mobility Program”). If you register under a Corporate Carpooling Program, please see the section within paragraph 9 below for further information about this.

To use these services, you need to create an account on the App, you need to have agreed to the T&Cs and you need to be at least eighteen (18) years old. Subject to the T&Cs, we will create an account for you upon registration.

To utilise the full functionality of the App, you will need to enable location services within your mobile device to enable us to track your location. If you do not allow the App to access location services within your mobile device some functions of the App will not work. For details of how we track your location, please see paragraph 7 below. We will associate any location data we collect from your mobile device with you and your account.

 

5. The kind of Personal Data we collect

We will collect, use and store various types of Personal Data about you when you register and use the Kinto Join Carpooling Service.

We would ask that you do not send us or disclose to us any Special Category Personal Data. This type of Personal Data is more sensitive and requires a higher level of protection. Special Category Personal Data includes information about an individual’s race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data about physical and/or mental health or data concerning a natural person’s sex life or sexual orientation. This type of information is not usually required but if it is, we will only process it with your prior explicit consent for a specific purpose stated in your consent.

The types of Personal Data we collect includes:

• Identity data: name, gender, photograph (if you have uploaded one to your profile), home and office address, username or nickname, information about who you are, such as specific workplace
• Contact data: email address and telephone number (mobile and work phone).
• Location, route and activity data: your geographical location, including real-time location (from your mobile phone’s GPS tracking functionality, Wi-Fi or Bluetooth) and your travel
• Ridesharing data: the date and time of the requested ride-sharing; pick-up and drop-off destination points (including place of employment, if applicable).
• Carpooling information and preferences: your interests and preferences regarding carpooling and who you have carpooled
• Vehicle data: information such as a pass number, or vehicle registration and the type of vehicle you drive.
• Sensor data and related device data from your mobile device: sensor data from the technology in your mobile device such as gyroscope, accelerometer, location data via GPS, heading, time-stamp and the motion of the mobile device, and any calculations made by your mobile device using such data. This information (together with the calculations made by your mobile device) will enable us to determine your method of travel (e.g., whether you are travelling in a car, on a cycle or on foot). We also use Bluetooth to transfer a unique user ID to identify when two known users are near each other to ascertain that they are travelling together.
• Other technical data: Internet Protocol (IP) address, your login data, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, event-logs and usage patterns.
• Your work/employment data: if applicable, your employer, place of work or office location and usual working hours, and any other information relating to your work or workplace which you supply or which we may discover as a result of your joining a Corporate Carpooling Program.
• Usage data: information about how you use the App or the
• Marketing data: your preferences in receiving marketing from us and our business
• Communications data: your communication
• Information you give to us: you may give us information by corresponding with us by phone, email or otherwise. This includes information you provide when you register to use the Website, App, request a demo, contact us through the website, enter a survey and when you report a problem with the Website or the App.
• Other data: any other information which we describe that we collect from you as referred to in this Privacy Policy and the Cookie Policy.

Further details about the type of Personal Data we collect and for what purpose are provided in the Schedule of Processing at the end of this document.

 

6. How we collect your Personal Data

We will collect your Personal Data directly from you in the following ways:

· Registration

When you register and make use of the Kinto Join Carpooling Service. In particular, when you register you will be asked to complete a registration form to provide Personal Data, such as your contact details and identity data. When you join and make use of a carpool, we will collect additional information from you such as your travelling preferences, vehicle data, location and route data.

· Text messaging and email

You may want to communicate with other users or with us through the messaging service available through the App and on the Website. During your correspondence, you will be providing Personal Data. We will process the Personal Data you provide to us to respond to you and provide the Kinto Join Carpooling Service. We will also communicate with you using email. For example, we will send you an email to let you know that you have a message waiting for you in the App. Messages and emails will be stored in accordance with the retention period set out in the Schedule of Processing which can be found at the end of this document.

· Customer Surveys

To continuously improve our products and services and adapt them to your needs, we regularly invite our users to participate in customer surveys. If you would like to participate, we will collect Personal Data from you as part of the process.

· Statistics

We may process your Personal Data to conduct anonymised and aggregated analyses and statistics about the use of our services.

· Request a demo or enquiries through our Website

We will collect your Personal Data directly from you, such as when you contact us directly to make an enquiry but, we may also collect Personal Data about you online, such as from LinkedIn or your company website.

 

7.How we use your Personal Data

We will use your Personal Data to provide you with the Kinto Join Carpooling Service. In particular, when you access and interact with the App or the Website, we need to track your activities to enable you to connect to the Kinto Join Carpooling Service. For potential customers, we will process your Personal Data when you request a demo or contact us through our Website.

We use tracking cookies to identify you in performance of this service, information of which is provided in detail in the Cookie Policy:

https://app.kinto-join.co.uk/corp/cookiepolicy/?country=united_kingdom&language=en

Our servers also receive and record information about your computer, device and browser, including your IP Address, browser type, and other software and hardware information.

If you access the App or the Website from a mobile or other device, we may collect a unique device identifier assigned to that device. As mentioned above (in paragraph 5, “sensor data”), if location services are enabled by you, we also collect location data and other sensor and calculation information for that device provided via your mobile device sensors.

The recording of location, route and activity data is necessary for the provision of the Kinto Join Carpooling Service as described in the T&Cs, since without it we cannot verify your mode of travel to match you with incentives offered by your employer as part of a Corporate Carpooling Program or match you with potential travel partners based on your preferred route(s) and time of travel.

We use this Personal Data, together with some of the sensor data and related device data to verify which route you choose, your method of transportation, and the actual performance of a carpool. (However, no location data is transferred via Bluetooth). We also use this data to identify other users who wish to commute in the same direction to match the users and allow the building of carpools.

We may contact you via in-app push notifications, email and / or phone to help you connect with colleagues and optimise your commute. You can control how we contact you in your settings.

We also collect information about your activities throughout your journey, such as your location, information about with whom you carpool, and the routes that you choose. The Personal Data that we collect about your activities are for example:

• Sensor data (as described above in paragraph 5, “sensor data”) such as specific geographic locations, through GPS or WiFi signals for the provision of our proof of ride share service, to include geolocation accelerometer and compass information, which is combined with your unique user ID. This helps us connect you with users in your
• Through your unique user ID you collect and pass to us details of your commute that allow us to verify carpooling activity such as number & ID of passengers, distances passengers are transported and times of specific events along your route/ commute/journey.

We will only use your Personal Data for the purpose we collected it and in accordance with the law. We will not use your Personal Data for any other purpose without your prior consent. The only exception to this is if it is required or permitted by law, such as where it is necessary for the prevention, investigation, detection or prosecution of criminal offences or the enforcement of civil law matters.

 

8. Our Legal Bases for processing your Personal Data

The UK GDPR requires that a Controller must have a legal basis for processing Personal Data. More details are provided in the Schedule of Processing but, in most instances, our legal bases for processing your Personal Data are:

• We have your consent
• We need to comply with a legal obligation
• It is necessary for our legitimate interests (or those of a third party, including you) and there are no overriding interests.

On rare occasions we may need to use your Personal Data as follows:

• We need to protect your vital interests or someone else’s. (This relates to life or death type scenarios).

 

9. Who we share your Personal Data with

Your Personal Data may be shared internally at Kinto Join Ltd for purposes of providing the Kinto Join Carpooling Service, which includes maintenance and troubleshooting activities. Responding to your requests through the Website, answering your queries, setting up and managing the contract with the organisation you work for.

Your Personal Data may also be shared as follows:

· Service Providers

We engage third parties to perform certain services and tasks necessary for the provision of the platform for carpooling and the handling of issues that require special know-how and special IT-Infrastructure that cannot be taken over internally. The hosting of the App or the Website, processing of the processes concerning the formation and handling of carpooling activities and providing the software technology and updates to support the platform for the formation and performance of carpooling are outsourced. We will share your Personal Data with our technical service providers, who will process your information only as instructed by us and only in the ways that are described in this Privacy Policy and the T&Cs. We ensure that we enter into written contracts with all technical service providers we instruct. These agreements place obligations on the providers to comply with the UK GDPR and all relevant data protection legislation and to act only under our strict instructions.

· Sharing with other users of the Kinto Join Carpooling Service

If you elect to join a carpooling group (including any Corporate Carpooling Program), your information, such as information about yourself, where you want to go, with whom you want to commute, which routes you take, how many journeys you have made and how much CO2 you have saved will be visible to other members of the relevant carpooling group. The date and time you last logged in may also be displayed but you can turn this off, if you wish. The sharing of information is necessary for the performance of the services. Accordingly, you should not join any carpooling group if you do not wish for your information to be shared with the other members of the group.

Keep in mind that if you share your Personal Data through social media plug-ins, by activating the share or like button, then your Personal Data will be displayed outside your closed-user carpooling group.

· Corporate Carpooling Program

We may share your Personal Data with your employer if you participate in a Corporate Carpooling Program.

These programs require users to register as an employee of a Corporate Carpooling Program customer using an email address associated with their employer’s business and participation allows the employers to offer benefits to their employees who choose to use more environmentally-friendly modes of transportation, such as carpools, using public transport or riding a bicycle to and from work. Employee participation in the carpooling program is optional. If you sign up, your employer may provide you with certain benefits depending on whether and how often you participate in carpools and use these services to build carpools.

We only share your Personal Data that is necessary to run the App or the Website and the App and for you to receive the incentives or benefits that may be offered by your employer, such as premium reserved parking, free coffees, lunch, or other incentives as deemed appropriate by your employer.

Your employer receives aggregated data about carpooling activities. You will be allocated a unique user ID and username, and we will illustrate to your employer through the carpooling dashboard on the Website your carpooling activities. Through your user ID and/or username, your employer may be able to identify you and ascertain who the frequent carpoolers are and the length of their journey.

Your employer may offer incentives for building and using carpools. Based on the information we provide to your employer; you may be entitled to receive certain benefits from them directly. Depending on what kind of benefits your employer is offering, it may be necessary for us to provide your employer with certain aspects of Personal Data to enable them to give you the benefits, such as a prize or coupon.

We do not share your location data with your employer. We do not inform your employer about who you are carpooling with. However, you should note that your employer may be able to establish these details from the information we do provide to them, depending on the nature of the particular Corporate Carpooling Program and the number of other individuals who participate in that Corporate Carpooling Program.

· Data transfer due to legal obligation

If we are obligated to transfer your data to a third party based on a legal obligation or in order to comply with applicable laws and governmental bodies, we will only do so in accordance with applicable laws (including the DPA 2018 and the UK GDPR). This may include for example, defense or pursuit of our legal claims involving your use of the carpooling services, investigate fraud, cooperating with criminal investigations, such as compliance with a subpoena, or similar legal process, or to the data protection supervisory authority.

When entering into contracts with third parties, we always require them to take appropriate technical and organisational measures to safeguard your Personal Data and confirm that they will adhere to the data protection law to ensure your Personal Data is kept secure.

We may share your Personal Data with other third parties if we sell or restructure the business.

We may also need to share your Personal Data with other third parties such as legal and/or professional representatives in order to comply with the law or legal obligation.

 

10. Marketing

With your consent, we may contact you via in-app notifications, push messages and email to promote our services. To start or stop receiving marketing from us, simply change your marketing settings in the App.

If you have provided consent, we may also contact you to promote services provided by third parties (e.g. insurance products and other services as they become available).

Where we are legally required to obtain your consent to provide you with marketing materials, we will only provide you with such marketing materials if you have provided consent for us to do so.

If you want to unsubscribe from mailing lists or any marketing, you can toggle-off the marketing settings in the App.

If you choose to unsubscribe from any or all marketing, we may retain information sufficient to identify you so that we can honour your request.

Potential Customers who request a demo or make contact through our Website.

We will provide you with information on our products and services that may be of interest to you under a Legitimate Interest. Should you advise us you no longer wish to hear from us we will add your details to a suppression list, and this can be done by emailing dpo@kinto-uk.com.

 

11. How long we will keep your Personal Data

We will only keep your Personal Data for as long as is necessary to fulfil the purposes we collected it for, which may include satisfying any legal, accounting, or reporting requirements. The retention period depends on the type of Personal Data and the reason we are processing it. Further details of retention periods are set out in the Schedule of Processing which can be found at the end of this document.

When calculating the appropriate retention period for your Personal Data, we consider the nature and sensitivity of the Personal Data, the purposes for which we are processing the Personal Data, and any applicable statutory retention periods. Using these criteria, we regularly review the Personal Data which we hold and the purposes for which it is held and processed.

When we determine that Personal Data can no longer be retained (or where we must comply you request us to delete your Personal Data in accordance with your right to do so) we ensure that this Personal Data is securely deleted or destroyed.

Remember that after you cancel or delete your account, copies of some information from your account may remain viewable in some circumstances where, for example, you have shared information on social media or you have used other services (e.g., messaging). We will use our best endeavours to contact any third parties to request the deletion of your Personal Data, if you request this.

Please note that, in some circumstances we may decide to retain your Personal Data for research or statistical purposes and in such circumstances, we will anonymise your Personal Data before retaining it. We may irreversibly anonymise your personal data so that it can no longer be associated with you, in which case we may use this anonymous information indefinitely without further notice to you.

 

12. Security of your Personal Data

In order to protect your Personal Data, we put in place appropriate organisational and technical security measures. These measures include ensuring our internal IT systems are suitably secure and implementing procedures to deal with any suspected data breach. We have held an UKAS accredited ISO 27001:2013 certificate for a number of years. ISO 27001 is a set of global standards that focuses on information security best practice.

In the unlikely event of a data breach, we will take steps to mitigate any loss or destruction of data and, if required, will notify you and any applicable authority of such a breach.

Although we use appropriate security measures once we have received your Personal Data, you will appreciate that the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect Personal Data, but we cannot guarantee the security of data transmitted to or by us.

 

13. Transferring your Personal Data outside the EU

To provide our services, we may need to share your Personal Data with third parties and suppliers outside the European Economic Area (the “EEA”). If we do this, we will ensure your Personal Data receives the same protection as if it were being processed inside the EEA. For example, our contracts with our suppliers stipulate the standards they must follow to process Personal Data.

In particular, your Personal Data may be processed by our service providers in Serbia. Our service providers in Serbia develop and test new products to improve the Kinto Join Carpooling Service. The transfer and processing of Personal Data to our service providers in Serbia is in compliance with the requirements of the UK GDPR regarding international transfers of Personal Data and the appointment of processors. We use the European Commission’s standard contractual clauses for data transfers from the UK to our service providers in Serbia. (see European Commission: Model contracts for the transfer of personal data to third countries)

14. Your rights

You have rights under the data protection legislation and, subject to certain legal exemptions, we must comply when you inform us that you wish to exercise these rights. There is no charge, unless your requests are manifestly unfounded or excessive. In such circumstances, we may make a reasonable charge or decline to act on your request. Before we action your request, we may ask you for proof of your identity. Once in receipt of this, we will process the request without undue delay and within one month. In order to exercise your rights please contact the Data Protection Officer at dpo@kinto-uk.com.

Your rights in connection with Personal Data are set out below.

· Subject Access Request

You have a right to receive a copy of the Personal Data we hold about

· Rectification

If any of the Personal Data we hold about you is incomplete or inaccurate, you have a right to have it

· Erasure

This is also known as the “right to be forgotten”. You have a right to ask us to delete your Personal Data where there is no good reason for us continuing to process it. However, certain criteria apply and if we have a legitimate reason to continue processing your Personal Data, we will not be legally required to delete it.

· Objection

You have a right to object where we are relying on legitimate interests as our legal basis for processing your Personal Data but, in certain circumstances we may be able to continue with the processing. For example, if we have compelling legitimate grounds which override your interests, rights and freedoms or your Personal Data is needed for the establishment, exercise or defence of legal However, you have an absolute right to object to us processing your Personal Data for direct marketing purposes.

· Restriction

You have a right to ask us to restrict the processing of your Personal Data in certain For example, you may require us to suspend processing your Personal Data whilst checks are made to ensure it is accurate.

· Portability

You have the right to ask us to transfer any Personal Data you have provided to us to another party, subject to certain criteria being satisfied. We will provide this Personal Data in a structured, commonly used and machine-readable format.

· Right to withdraw consent

If you have given us your consent for the processing of your Personal Data (where consent is the lawful basis for processing), you can withdraw this at any Please note, the withdrawal has no effect on the legality of the data processing carried out in the past on the basis of your consent. To exercise your right to withdraw consent go to your profile and uncheck the relevant check box or slider in the App.

· Automated Decision Making

You have the right to object to any decisions which significantly affect you if they are made solely by automated In these circumstances, you are entitled to ask for human intervention. Some decisions within the Kinto Join Carpooling Service are made solely by automated means. For example, if your employer allocates priority car park spaces to users of the Kinto Join Carpooling Service, the allocation may be entirely automated, depending on how the facility is set up with your employer. In these cases, a “digital ticket” will be automatically sent to your mobile phone which you can use to access the car park. However, if you do not receive a “digital ticket” but you are expecting one, you may click on “where is my ticket” and when this happens the Kinto Join support team will be alerted to the problem and will look into it. Therefore, human intervention will be provided.

· Right to complain

If you are unhappy with the way in which your Personal Data has been or is being processed, you have the right to make a complaint about it to the Information Commissioner’s Office (ICO). They can be contacted at:

Information Commissioner’s Office Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

www.ico.org.uk

 

15. Your obligations

If any of your Personal Data changes whilst you are a user of the Kinto Join Carpooling Service, it is important that you update the information within your profile to ensure that the data we hold about you is accurate and up to date.

 

16. How to contact our Data Protection Officer

We have appointed a Data Protection Officer (DPO) to handle data protection matters. If you wish to contact us in order to exercise any of your rights referred to above or any other data protection matter, please contact the DPO via email dpo@kinto-uk.com. Alternatively, you may write to our DPO at:

Data Protection Officer

Building 1000

Lakeside North Harbour

Western Road

Portsmouth

Hampshire

PO6 3EN

United Kingdom

 

17. Questions or concerns

You can contact us if you wish to complain about how we collect, store and use your Personal Data (please see the contact details of our data protection officer in paragraph 16 above).

It is our goal to provide the best possible remedy with regard to your complaints. However, if you are not satisfied with our answer, you can also contact the Information Commissioner’s

Office. The ICO is the relevant supervisory authority in the UK. Their contact details are specified above under paragraph 14.

 

18. The Data Protection Principles

We will comply with the UK GDPR and the DPA 2018. Article 5 of the UK GDPR contains the data protection principles, which require that Personal Data shall be:

1. processed lawfully, fairly and in a transparent way
2. collected for specified, explicit and legitimate purposes and not used in any way that is incompatible with those purposes
3. adequate, relevant and limited to what is necessary
4. accurate and, where necessary, kept up to date
5. kept for no longer than is necessary for the purposes we have told you about
6. kept secure

19. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy from time to time. Updates to this Privacy Policy will be published on the Website and the App. To ensure you are aware of when we make changes to this Privacy Policy, we will amend the revision date at the top of this page. Changes apply as soon as they are published on the Website and the App. We therefore recommend that you visit this page regularly to find out about any updates that may have been made.

 

20. Schedule of Processing – Kinto Join Ltd customers

Ref	Purpose of Processing	Type of Personal Data	Who has Access	Legal Basis	Retention Period
1.	To identify you in order to create your user profile	Identity data	Kinto Join Community Support Staff (Point of contact / first-line support for the end user and Community Administrator)   Community Administrator (staff of the employer in relation to Corporate Carpooling Program communities)	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
2.	To contact you in relation to your use of the carpooling service	Contact data	Kinto Join Community Support Staff	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
3.	To contact you in relation to your use of the carpooling service	Work email address (part of the Contact data)	Community Administrator	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
4.	To calculate a theoretical route to work (community destination) to find suitable travel partners	Home address (also referred to as ‘pick up / drop off point’ can be any address the user would like to be picked up from / dropped off to)	Other users, including Community Administrator, by way of the Community map (pseudonymised and approximated – users only see other users’ display name and map location is based on a truncated postcode)   Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested or to find suitable travel partner and suggest them to you via email, in-app message or phone	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
5.	To find suitable travel partners based on similar arrival times	Normal working hours	Kinto Join Community Support Staff will only access this data in the event some debugging, or support activity is requested or to find suitable travel partner and suggest them to you via email, in-app message or phone	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
6.	To record your journey to work for the purpose	Location data	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested or to find suitable travel partner	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.

 

	of finding suitable travel partners		and suggest them to you via email, in-app message or phone
7.	To record your journey to work for the purpose of verifying a carpool	Location data	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
8.	To record your journey to work for the purpose of verifying whether you are travelling by transport or by bicycle or on foot	Activity data	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
9.	To enable the carpool arrangement to work	Ridesharing data – travel times and users you intend to travel with	Users identified   Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
10.	To enable you to communicate with Kinto Join	Text messages within the Kinto Join App and emails between you and Kinto Join	Kinto Join Community Support Staff	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
11.	To enable you to communicate with other users	Text messages within the Kinto Join App between you and other Users	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
12.	To enable you to find carpools which are suitable for you	Carpooling information and preferences	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
13.	To enable passengers and carparks to identify your vehicle	Vehicle data	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested   Carpark operatives in the event this needs to be shared with them for carpark administration	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.

 

14.	To enable us to determine your method of travel ie: on foot, bicycle or by transport or working from home	Sensor data and related device data from your mobile device	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
15.	To enable us to identify you as part of a Corporate Carpooling Program	Your work / employment data	We don’t specifically collect this, but it is inferred from the community you join. For example, if you join the ABC Community with an ABC email address which you verify, it will be inferred that you work at ABC	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
16.	To enable us and/or others to send marketing material to you	Marketing data, communications data and Contact data	Kinto Join and third parties you consent to	Consent	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
17.	To enable you to keep track of your cost of travel and the savings (£, CO2, etc) you make as a result of using the carpool	Carpooling activity data (miles covered, passengers transported, journeys undertaken etc.)   Transaction data	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
18.	To enable your employer to accurately and confidently disburse incentives and rewards for carpooling.	Carpooling activity data (cumulative data describing journeys undertaken, carpools verified, carpooling miles covered, passengers transported, etc.)	Kinto Join Community Support Staff will only access this data in the event that some debugging or support activity is requested and to monitor the performance of a Corporate Community   Community Administrator	Legitimate interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
19.	To enable us to provide you with a better user experience including maintenance and troubleshooting.	Information you give to us	Kinto Join Community Support Staff	Legitimate interests	12 months from the date you provided the information to us
20.	To enable us to provide you with a better user experience including the development and testing	Usage data, aggregate and Anonymised	Kinto Join, web analysts and support teams	Consent is obtained for all but essential cookies	The retention period for each type of cookie is set out in our Cookie Policy
	of new products to improve the carpooling service	Cookies – See our Cookie Policy
21.	Customer Surveys	Feedback	Kinto Join and analytics and support teams	Legitimate interests	12 months from the date of the survey.
22.	To enable us to send you updates and service messages	Contact Data	Kinto Join Community Support Staff	Legitimate Interests	12 months from the last date of activity on the account or when you ask us to delete your account, whichever is the sooner.
Ref	Purpose of Processing	Type of Personal Data	Who has Access	Legal Basis	Retention Period
1.	To carry out our obligations under our contract with the organisation you work for	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legitimate interests	6 years from the date the contract ends
2.	To communicate with you in connection with our contract with the organisation you work for	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legitimate interests	6 years from the date the contract ends
3.	To process your enquiries or provide a quotation for a product or service	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legitimate interests	3 years from the date of our last meaningful contact with you
4.	To connect with you to offer our products and services	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legitimate interests	3 years from the date of our last meaningful contact with you
5.	To provide you with information on our products and services that may be of interest to the organisation you work for	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legitimate interests	3 years from the date of the last meaningful contact
6.	To retain a written record of the outcome of sales phone calls	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legitimate interests	3 years from the date of the last meaningful contact
7.	To retain a suppression list (when you advise us you no longer wish to hear from us)	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legal obligation	Indefinitely
8.	To process Data Subjects’ Rights	Identity Data & Corporate Contact Information	KINTO Join Community Support Team	Legal obligation	6 years from the date of the enquiry